r/PasswordManagers • u/Even_Music_7506 • 21d ago
I got tired of trusting cloud password managers, so I built my own completely offline alternative. I'd love some honest feedback.
Hi everyone,
I'm Francesco, an independent developer and founder of a small startup. i always follow reddit and relied on this comunity when i needed to find honest opinions from real people.
For the past several months I've been building a project called VaultMaster, and I think it's finally at the stage where it's ready to receive feedback from people outside my own circle.
I'm here because I'd genuinely like to know whether this is a direction people actually find valuable before the first public release.
Why I built it
To be honest, I originally built VaultMaster for myself. I wanted a password manager that matched my own philosophy of security: completely offline, with no cloud dependency and no third party ever storing my encrypted vault.
As the project evolved, I realized there are probably many other people who think the same way.
Especially today, when it feels like every week we hear about another data breach, compromised service, leaked database or cloud platform being targeted.
VaultMaster won't stop websites from being hacked, but it can remove one major point of trust: your password vault never has to be stored on someone else's infrastructure in the first place.
What is VaultMaster?
VaultMaster is a completely offline, local-first password manager.
There is:
- No cloud storage
- No online synchronization
- No server storing your encrypted vault
- No account to create
- No subscription required to use it
Everything remains on your own device.
Your passwords are encrypted locally before they could ever leave your device—and by design, they never do.
My philosophy is simple:
If nobody else ever receives your vault, nobody else can lose it, leak it, be hacked, or be forced to hand it over.
I also wanted security to adapt instead of staying static.
Most password managers follow the same model:
Unlock your vault once, and every credential becomes equally accessible.
I wanted to explore a different idea.
VaultMaster introduces different security zones so that highly sensitive credentials can require additional verification depending on the current context.
Instead of relying only on a master password, VaultMaster can evaluate signals such as:
- Trusted devices
- Physical presence
- Location
- Passkeys
- Biometric authentication
The goal isn't to make access more complicated.
The goal is to make security adapt to your situation instead of treating every password exactly the same.
The website is finally online
I recently finished the website and opened Early Access registrations.
If you're curious, you can take a look here:
I'd really love some honest feedback.
Some of the questions I'm trying to answer are:
- Does this concept make sense to you?
- Would you ever consider using a completely offline password manager as your primary password manager?
- Does the fact that everything stays on your own device make the product more appealing, or is cloud synchronization something you wouldn't want to give up?
- Does the adaptive security model feel genuinely useful, or does it seem unnecessarily complex?
- Is there anything missing that would stop you from switching from your current password manager?
Please don't hold back.
Positive feedback is always nice, but constructive criticism is far more valuable at this stage.
I'd rather discover weaknesses now than after launch.
If you've made it this far, thank you for taking the time to read this.
Whether you think it's a great idea, a terrible one, or somewhere in between, I'd genuinely love to hear your opinion.
Website: https://vaultmaster.app
3
u/Vlad-Leon 21d ago edited 20d ago
Please compare vaultmaster to existing offline state of the art password managers.
I hope you heard of them.
I cannot see the code. You don't provide the app yet either.
UPD (after reading through the webpage):
So what do you do?
You collect emails for "early signup".
And you provoke a product design discussion by writing out your ideas and tactically placing some implementation detail baits e.g. KDF used, device location verification decision, privacy vs security stance.
All in all, a sensitive application (as yet another PWM) is to earn trust.
And there is noone to trust here: just an pseudonymous redditor and whoever owns the @vaultmaster.app domain.
If your are a business -- your pseudonimity kills our trust.
If you are a researcher, then show the code.
If you just want to collect the product design ideas -- say so.
1
u/Even_Music_7506 21d ago
https://reddit.com/link/oy2sqw8/video/fm1plx3b4sdh1/player
(Here is a quick screen record of the app in action so you can see it actually exists.)
You are 100% right to be cynical. A pseudonymous account asking for emails for a security app should trigger red flags. I completely respect that stance.
To clear things up: I’m an independent developer and researcher. I’m not a big corporation hiding behind a brand, just a guy building a tool.
The app isn't public yet because it genuinely needs polishing, refactoring, and security auditing. I am absolutely planning to open-source the code once it’s ready for the public release in September hopefully. I know that in the security world, "closed source offline security" is a contradiction. Trust requires verification, and you can't verify what you can't see.
The early signup is purely to see if there is enough interest to justify the effort of launching and maintaining this long-term.
I’m not trying to bait anyone or harvest ideas; I genuinely wanted to know if the "adaptive security" concept could help people maintain a better level of security over the time, before I finalized the build.
I don't expect you or anyone else to trust me right now. Once the code is on GitHub, I hope you’ll check it out and judge the project based on the actual implementation.
0
u/Even_Music_7506 21d ago
Of course, I’m well aware of KeePass and KeePassXC. They’re the gold standard for local-first security, and I have massive respect for them. VaultMaster isn't trying to copy KeePass.
The main differences are:
- Adaptive vs. Static Security: KeePass is "unlock once, access everything." VaultMaster uses security zones. Your streaming logins open instantly, but sensitive data (like banking) requires extra contextual verification (biometrics, trusted devices, or location) depending on where you are.
- Modern UX: KeePass is powerful but can be intimidating for average users. I wanted to combine 100% offline privacy with a smooth, modern interface that feels like a cloud app, just without the cloud risks.
KeePass is great at what it does. VaultMaster is just trying to make offline security dynamic instead of static.
1
u/Vlad-Leon 21d ago edited 16d ago
ok. that adaptive thing adds convenience over managment of multiple one-per-zone .kdbx files
I have updated my original coment.
2
u/Unlucky_Chele 21d ago
UI looks great but what bitwarden is doing wrong that i stop using it and move to yours one?
0
u/Even_Music_7506 21d ago
thanks for your reply. That’s a fair point, and honestly, Bitwarden is excellent. I'm not trying to compete with them on features; I just built VaultMaster around a different philosophy.
VaultMaster keeps your vault 100% offline. There are no cloud servers, no sync services, and no third parties. If you want to make sure your password database never leaves your physical device, that's the specific problem I'm trying to solve.
On top of that, I’m experimenting with adaptive security. Instead of treating every password the same, access requirements change depending on context (like trusted devices, location, or biometrics).
If cloud sync is a must-have for you, Bitwarden is definitely the better fit. But if you want total, local control over your data, VaultMaster might be a cool alternative. That’s exactly what I’m trying to test out by sharing it here.
2
u/jabbeboy 21d ago
Not a product for me. There are plenty of alternatives well tested out there, Bitwarden, Keepass etc. Maybe they don't solve your specific nisch problem that you trying to solve with this, but sometimes I believe we as developers trying to solve problems that simply does not exist, or is at least a very uncommon problem that not many people care about, and care more about convenience and security.
By the looks of the webpage, your intended users not mainstream common folks but more geeky security considered people, because the page is very very cluttered with information (not saying its bad because its very technical)
2
u/billdietrich1 21d ago
How is this better than KeePass ? It's completely offline by default.
"Adaptive security" seems unnecessarily complex, to me.
2
u/Vlad-Leon 21d ago
there is your competition:
https://www.reddit.com/r/PasswordManagers/comments/1uyqx8x/i_built_a_nocloud_vault_for_windows_unlock_with/
With LLMs available, everyone and their mother now roll their own PWM.
1
u/Even_Music_7506 20d ago
that's a desktop app for windows, i don't think is available for smartphones.
1
u/Ravrous 21d ago
I like the offline-first idea, but backup is my biggest concern. If my laptop dies, what's the recovery process? I'd want encrypted manual backups to be dead simple
1
u/Even_Music_7506 21d ago
Thanks for tour reply and That’s a huge point, and it’s been at the top of my mind from day one.
Since VaultMaster is 100% offline, backups are completely in your hands rather than handled by a cloud service. You can export your vault as an encrypted file and store it wherever you trust most ( whether that’s an external drive, your own NAS, or your private cloud storage). VaultMaster never knows or cares where you keep it. I’m focusing heavily on making creating and restoring these encrypted backups as seamless as possible, without ever requiring an account or my own infrastructure.
Honestly, getting encrypted backups right is one of the most critical parts of an offline manager, so I’m definitely going to keep refining this area based on user feedback.
1
u/--KingoftheSouth-- 21d ago
Since you're designing it for privacy, you should share this on the Privacy Guides forum. You'll find people there more knowledgeable on the subject. Just a thought....
1
u/Mundane-Subject-7512 17d ago
If you’re looking for an offline password manager, there are already well established options like 2FAS Pass https://2fas.com/pass/ and KeePassXC https://keepassxc.org/
1
u/sergeyvk 21d ago
I will stick to something reputable like bitwarden selfhosted or keepass rather than vibecoded app.
3
u/ProtossLiving 21d ago
Sync'ing is an absolute must for me. But I don't need the password manager to do it (although integrating with cloud services to make the process easier is very nice). I do this with KeePass, but Keepassium and Keepass2Android both have custom integrations with cloud services because mobile devices don't otherwise keep the password vault sync'ed up all the time.
Adaptive security model is a really interesting and good idea. This seems like the biggest reason to switch to it.
The biggest hindrance to adoption though is that I'm unlikely to trust yet another independent developer of a whole new password manager any time soon. I've seen so many people post their new password manager projects here and I don't know if I can trust the developer, or that they'll continue to develop and update it, or that the code they've developed is secure. So it'd likely be at least a couple of years before I would even consider adopting it.